CVE-2026-20354

Summary

Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attacker to recover plain text from encrypted email messages.

These vulnerabilities are due to insufficient validation of message integrity. An attacker could exploit these vulnerabilities by using a machine-in-the-middle technique to intercept and modify traffic between email gateways. A successful exploit could allow the attacker to obtain plaintext content from the encrypted communication.

Affected Software

VendorProductVersion RangeStatus
CiscoCisco Secure Email14.0.0-698affected
CiscoCisco Secure Email13.5.1-277affected
CiscoCisco Secure Email13.0.0-392affected
CiscoCisco Secure Email14.2.0-620affected
CiscoCisco Secure Email13.0.5-007affected
CiscoCisco Secure Email13.5.4-038affected
CiscoCisco Secure Email14.2.1-020affected
CiscoCisco Secure Email14.3.0-032affected
CiscoCisco Secure Email15.0.0-104affected
CiscoCisco Secure Email15.0.1-030affected
CiscoCisco Secure Email15.5.0-048affected
CiscoCisco Secure Email15.5.1-055affected
CiscoCisco Secure Email15.5.2-018affected
CiscoCisco Secure Email16.0.0-050affected
CiscoCisco Secure Email15.0.3-002affected
CiscoCisco Secure Email16.0.0-054affected
CiscoCisco Secure Email15.5.3-022affected
CiscoCisco Secure Email16.0.1-017affected
CiscoCisco Secure Email15.5.4-012affected
CiscoCisco Secure Email16.0.4-016affected
CiscoCisco Secure Email15.0.5-016affected
CiscoCisco Secure Email16.0.2-112affected
CiscoCisco Secure Email16.0.3-044affected
CiscoCisco Secure Email16.5.0-780affected

Weaknesses

  • CWE-354: Improper Validation of Integrity Check Value

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References